Cross-site scripting in noVNC - CVE-2017-18635
Published: September 26, 2019 / Updated: July 20, 2020
Vulnerability identifier: #VU30739
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear
CVE-ID: CVE-2017-18635
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: kanaka (Joel Martin)
Affected software:
noVNC
noVNC
Detailed vulnerability description
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via the messages propagated to the status field, such as the VNC server name. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
How to mitigate CVE-2017-18635
Update to version 0.6.2.
Sources
- https://access.redhat.com/errata/RHSA-2020:0754
- https://bugs.launchpad.net/horizon/+bug/1656435
- https://github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534
- https://github.com/novnc/noVNC/issues/748
- https://github.com/novnc/noVNC/releases/tag/v0.6.2
- https://github.com/ShielderSec/cve-2017-18635
- https://lists.debian.org/debian-lts-announce/2019/10/msg00004.html
- https://www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack/